Fixed #1684 by returning a 403 when API key is present but invalid

Fixes #1684